CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization has determined that accounts belonging to terminated employees are not disabled or deleted within the period required by corporate policy. Because it is uncertain of the cause, the organization has chosen to monitor the situation for three months to gather additional information. As a result, the risk has been:

A accepted.
B transferred.
C avoided.
D mitigated.

Explanation

Risk acceptance occurs when an organization knowingly tolerates an identified risk without taking action to reduce, transfer, or eliminate it. Monitoring the issue for three months does not itself remediate the delayed account deprovisioning.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ291

Community Discussion